Hi is there a way to assign only a set of permissions to an access key? We dont want to associate roles

Hi, I'm Descope's AI assistant. I've put together an initial response below based on your question. A member of the support team will take over and follow up shortly. Permission Structure Permissions cannot exist independently - they must be assigned to roles. Roles can have specific permissions assigned (e.g., "Admin" role with "documents:read", "documents:write" permissions). Roles can also be standalone without pre-defined permissions for organizational or programmatic use. Recommended Approach Create dedicated roles for your access keys with only the specific permissions needed: 1. Create a custom role with just the permissions you want 2. Assign that role to the access key 3. This gives you granular permission control without broad role access For example, you could create roles like: • "API-ReadOnly" with only read permissions • "API-DataWrite" with specific write permissions • "API-ReportsAccess" with reporting permissions This approach maintains the security principle of least privilege while working within Descope's role-based architecture.

This doesnt make much sense to me since roles are a higher abstraction than permissions. If we want fine grained access tokens there is not way to do that in our application?

Hey @drake evans (agora), You need to provide the roles with the permissions for the access key. In the access key JWT template you can decide to include only permissions in the generated JWT for that access key:

So if I want my users to be able to scope an API key/access key to a single permission is that not possible?